GDPR Compliance Statement

Last Updated: November 3, 2026

Our Commitment to GDPR

Node-comet complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to protecting your personal data and respecting your privacy rights.

This document explains how we meet our GDPR obligations and how you can exercise your data protection rights.

Data Controller Information

Node-comet is the data controller responsible for your personal information. Our contact details:

Node-comet
142 Clerkenwell Road
London EC1R 5DL
United Kingdom

Legal Basis for Processing

We process your personal data under the following legal bases:

Contractual Necessity

Processing is necessary to fulfill our card recovery service contract with you. This includes identity verification, coordination with ATM operators, and delivery arrangements.

Legitimate Interests

We have legitimate business interests in:

  • Preventing fraud and ensuring service security
  • Improving our services based on usage patterns
  • Maintaining business records
  • Responding to legal requests

We balance these interests against your rights and only process data when our interests do not override your fundamental rights.

Legal Obligations

We process certain data to comply with legal requirements, including financial record-keeping and anti-money laundering regulations.

Consent

Where required, we obtain your explicit consent before processing. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Your GDPR Rights

Right to Access

You can request a copy of the personal data we hold about you. We will provide this within one month of your request, free of charge.

Right to Rectification

If your personal data is inaccurate or incomplete, you can request that we correct or complete it.

Right to Erasure

You can request deletion of your personal data when:

  • The data is no longer necessary for the purposes collected
  • You withdraw consent and no other legal basis exists
  • You object to processing and no overriding legitimate grounds exist
  • The data has been unlawfully processed

This right is not absolute. We may need to retain certain information to comply with legal obligations.

Right to Restrict Processing

You can request that we limit how we use your data when:

  • You contest the accuracy of the data
  • Processing is unlawful but you don't want erasure
  • We no longer need the data but you need it for legal claims
  • You have objected to processing pending verification of our legitimate grounds

Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format. You can also request that we transfer this data directly to another controller where technically feasible.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of your GDPR rights, contact us using the details provided above. Please include:

  • Your full name and contact information
  • Description of the right you wish to exercise
  • Any relevant case or reference numbers
  • Proof of identity if requested

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of any delay.

Data Processing Principles

We process your personal data in accordance with GDPR principles:

Lawfulness, Fairness, and Transparency

We process data lawfully, fairly, and transparently. We clearly explain our processing activities.

Purpose Limitation

We collect data for specified, explicit, and legitimate purposes. We do not process data in ways incompatible with those purposes.

Data Minimization

We collect only data that is adequate, relevant, and limited to what is necessary for our purposes.

Accuracy

We take reasonable steps to ensure personal data is accurate and kept up to date. Inaccurate data is erased or rectified promptly.

Storage Limitation

We retain data only as long as necessary for the purposes collected or to comply with legal obligations.

Integrity and Confidentiality

We process data securely using appropriate technical and organizational measures to protect against unauthorized or unlawful processing, accidental loss, destruction, or damage.

Accountability

We are responsible for and can demonstrate compliance with GDPR principles.

International Data Transfers

We primarily process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

  • Adequacy decisions recognizing equivalent data protection
  • Standard contractual clauses approved by authorities
  • Binding corporate rules where applicable

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach. We will also notify the Information Commissioner's Office as required.

Notification will include the nature of the breach, likely consequences, and measures taken or proposed to address the breach.

Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately for deletion.

Complaints and Supervisory Authority

If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Website: ico.org.uk

We encourage you to contact us first so we can address your concerns directly.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website and, for active users, via email.